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SafeteRepH Provides safety assessment and 
advice for board members 

Pilot Rep — functional specialty 

Maintenance Rep H functional specialty 

Human Factors Rep H functional specialty 

Ex-officio Hensures process and final report 
adhere to NASA standards 







■ Quality Rep — functional specialty 

■ Legal* - handles legal issues 

■ Export Control* 

■ Public Affairs* - manages PA issues 

All ensure final document is appropriately annotated for 
the type of material and is accurate 


Required by NASA standards 




Appointed by letter 

Trained in investigation 

75 working days to deliver report to 
appointing authority 

Expected to release immediately 
information having safety impact 
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Find Root and Proximate Cause 

Make Recommendations for Root and 
Proximate causes 




I P nr R \ s i r £-* / i i‘ 


:: T he event(s) that occurred, including 

any condition(s) that existed immediately before the 
undesired outcome, directly resulted in its occurrence and, 
if eliminated or modified, would have prevented the 
undesired outcome. Also known as the direct cause (s). 
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One of multiple factors (events, conditions, 
that are organizational factors) that contributed to or 
created the proximate cause and subsequent undesired 
outcome and, if eliminated or modified, would have 
prevented the undesired outcome. Typically, multiple root 
causes contribute to an undesired outcome. 
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An event or condition that 
may have contributed to the occurrence of an 
undesired outcome but, if eliminated or modified, 
would not by itself have prevented the occurrence. 





Chronology of Events 




Damaged Precooler Identified 

Precooler Replaced & Checked 

/Aircraft Flies Round Trip to Baltimore 

Combined Postflight Preflight (8:00 AM) 

^ Aircraft Takeoff — Caution Light (9:55 AM) 

Crew Addresses Caution Light (10:00 — 10:30 AM) 
Crew Lands at Dallas Love Field (10:50 AM) 

FE Troubleshoots Caution Light 
-FE Notes Visual Damage & 

Aircraft Impounded (1 :00PM)\ \ Heat/Odor in Aft Compartmen 


5/22 
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Damage 
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Aft Equipment Bay Heat Damage 


Evidence of possible Forward and Aft 
Engine mount isolator heat damage 
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{VIEW LOOKING INBOARD) 












Bottom Line 
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$605K in damage to fuselage structure and pylon panels 
Proximate Causes — 

■ Precooler coupling installed without retaining ring allowed 
400 deg F/40 psi air to damage structure and disable primary 
warning system (SPF) 

■ Wiring to the pylon hot warning system temperature sensor 
broke, disabling the system and preventing the primary 
aircrew warning of the bleed air leak condition. 



Root Causes — None 

■ Did not uncover any systemic organizational factors 



Bottom Line 




■ Significant Intermediate Causes 

■ The maintenance and inspection technical data (Computerized 
Maintenance Program (CMP) task card, Illustrated Parts Catalogue (IPC), 
and Aircraft Maintenance Manual) associated with the precooler 
installation did not identify, depict, and establish the importance o£the 
retaining ring to the HPE coupling and its viability. 

■ The lack of restraint and protection of the pylon hot warning system 
temperature sensor wiring allowed the wiring to break under the 
conditions of a bleed air leak from a discon-nected precooler HPE 
coupling before the warning system could activate. 



Other factors contributed 



Causal Tree Legend 
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‘And” Logic Gate 


“Or” Logic Gate 


Subtree Designation 



Event 


Root Cause (Bold Border) 


Condition 


') Contributing Factor (Dashed Border) 


When attached below an event or condition indicates that the span of 
control to obtain or resolve that data is limited 




Maintenance Documentation 


CMP ^Computerized Maintenance Program: 

■ Series of tasks in checklist form for maintaining the 
aircraft. 

■ Maintained by aircraft manufacturer 

I Electronic dlb.se - printed out for each assigned 
task 




Maintenance Documentation 



Illustrated Part Catalogue 

■ Diagrams of all subsystems and aircraft 

■ Created by aircraft manufacturer 
HOnlme reference that can be printed out 

■ Maintained by aircraft manufacturer 



Maintenance Manual 



Description of subsystems and their function 
O nlin e reference that can be printed out 
Maintained by aircraft manufacturer 



Causal Tree - Top Level 
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Aircraft was 
damaged from 
heat in pylon - 1 

TJ“ 



exhaust coupling 
disconnected 4 
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Evidence 

• Aircrew Testimony 

• No discussion on CVR 


Pylon hot warning 
system wire was broken 
by the bleed air leak 5 
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Evidence 

• Caution Light on Takeoff 

• Last functional check 

• Precooler replacement closeout 
after leak check 


No other hot air 
leak indications 
were apparent to 
flight crew 
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Pylon Hot Sensor Wire Breaks 





Pylon Hot Sensor Wire Breaks 
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No Other Indications of Leak 




No other hot air leak 
indications were 
apparent to crew 


n 
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Temperature in aft compartment did 
not reach the activation point of the 
aft equipment temperature warning 
systems 



Engine indications 
were within normal 
variance 



AUX MASTER WARN CB 
checklist procedure did not 
identify the pylon hot 

condition 21 


* Warning System design x s 

does not identify a single \ 

offending system and the 21 / 
n associated causal event ^ ' 



No Other Indications of Leak 
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Q Evidence 

• Multiple warning sensors did not 
Evidence ictivate (200 deg F) 

• No significant engine parameter differences Lire Bottles did not discharge (185 

reported v 

• Bleed air manifold pressure reported normal tsulation material melting point 

• FDR had no engine data * Limited to manifold entrance 

• Temp 220 deg F 




Temperature in aft compartment did 
not reach the activation point of the 
aft equipment temperature warning 
systems 



Engine indications 


were within normal 
variance 


AUX MASTER WARN CB 
checklist procedure did not 
identify the pylon hot 

condition 21 


TXT 

Warning System design 
does not identify a single 
offending system and the 
associated causal event 



No Other Indications of Leak 
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n associated causal event 






Precooler HPE Coupling 
Disconnects 


Aircraft was 
damaged from 
heat in pylon i 


U 



Pylon hot warning 
system wire was broken 
by the bleed air leak 5 




= Event 

= Root Cause (bolded border) 
= Condition 






HPE Coupling Disconnects 
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Evidence 

• Third flight w/ o retaining ring 
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Precooler H 

just (HEt) doUhlUid 

liWnnected 


Evidence 

• Discovered upon next pylon inspection 
since precooler replacement 







Sufficient Force /Vibration 
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RR Missing on Precooler 






RR Missing — Poor Config Control 
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Contractor re turb is hed 
I precooler assembly | 

y configuration control / 

(CC) was non-existent 


Precooler assembly does not meet 
contractor's verbal criteria for CC of 
a complex assembly « 



Precooler installation CMP card | 

does not require CC | 


i 



33 | 
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RR Missing — 



Poor Conf Evidence: 

•Refurbishment vendor does not track 
config (sends what he receives- usually 
unit is not the one you removed) 

• Vendor refurbishment procedure does 
jjjj not detail a configuration (FAA 
approved) 




RR was not 
installed on PEC 
at repair facility 




RR was remov| 

repair facility and not 
replaced 


Removal and 
Replacement and not 
replaced 35 


Supplier refurnished 
pre cooler assembly 
configuration contrc| 
was non-existent 


Evidence 

• Procedure created by precooler developer 

• FAA approved the procedure 


FAA approved contractor 
procedure without assembly 
confi gurati on co ntrol 



Precooler assembly does not meet 
contractor's verbal criteria for CC of 
a complex assembly 
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Precooler installation CMP card 
does not require CC 
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RR Missing — Poor 
Configuration Control 


A 


Evidence: 

• Contractor does not track unit 
configuration in or out of supplier 
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Evidence: 

• Contractor relies on CMP to employ 
configuration control 
Evidence: 

• CMP card for R&R precooler does 
not invoke CC 


IR was removed at 
jpair facility and not 
replaced 


Supplier refurbisn 
)re cooler assembly 

I onfiguration control 
was non-existent 
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RR was removed 
during previous 
Removal and 
Replacement and not 
replaced 35 


Contractor refurbished 
precooler assembly 
configuration control 
(CC) was non-existent 
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Precooler assembly does not meet 
contractor's verbal criteria for CC of 
a complex assembly 
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Precooler installation CMP card 
does not require CC 
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DSI Did Not Inspect for RR Mnriaat Ulis 11 ® 






DSI Instructed and Inspected 
T ask Simultaneously 



Designated System 
Inspector (DSI) did not 




Evidence qualified on 

• FAA maintenance foundation built on A&F certincanon 

• Contractor employs same practice 

• Fails to account for experience in specific airframe 


Evidence 

• Trainee signed off card/DSI signed DSI block 

• Training process does not recognize trainee as 
qualified on the task until supervisor signs record 


Individual followed 
incomplete, published R&R 
procedure <15 


DSI instructed and inspected the 
task simultaneously 


DSI assumed "delivered" preecooler 
is a serviceable configuration 


ZA 


Use ofA&P licensed 
individual is a 
contractor and FAA- 


\ 
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accepted practice 


** accepted practice 
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DSI Assumes Serviceable 
Precooler 




Precooler assembly arrives with aj 
serviceability tag 
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■ ^ Experience was that RR 
was normally delivered 
with the repaired PEC on 

precooler < 
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Supplier refurbished 
precooler assembly 
configuration control 
was non-existent 
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The installation procedure 
can be performed without 
removing the female 
coupling from pre cooler 

'"O'" 
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Contractor refurbished 
precooler assembly 
configuration control 
(CC) was non-existent 











DSI Assumes Serviceable 
Precooler 
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Evidence: 

• O-rings can be installed without 
removing female portion of coupling 

• Coupling halves join after precooler 
and duct in place 


Precooler assembly arrives with a 
serviceability tag 
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Experience was that RR 
was normally delivered 
with the repaired PEC on 
precooler 



Supplier refurbished 
precooler assembly 
configuration control 
was non-existent 




Contractor refurbished 
precooler assembly 
configuration control 
(CC) was non-existent 






DSI Assumes Serviceable 
Precooler 









DSI Followed Incomplete 
Procedure 
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DSI instructed and inspected the 
task simultaneously 

✓ Use of A&P licensed ^ ^ 

' individual is a ^ 

v contractor and FAA- ° ' 
accepted practice + 
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DSI assumed "delivered" preecooler 
is a serviceable configuration 

A 






Incomplete Precooler 
R&R Procedure 







Trainee Did Not Inspect 

for RR 





Precooler High Pressure 
Exhaust (HPE) coupling 
disconnected 4 

zsz 


Designated System 
Inspector (DSI) did not 
inspect for RR 13 
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T rainee did not 
inspect PEC forRR 



Maintenance personnel I 
did not update technical 1 
data 23 * 



Inspecting forRR was not 
part of installation technical 
documentation 2 
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No Organizational Factors 



Maintenance Training 

■ No real identified deficiency since task 
documentation was deficient 

Some technicians knew of the Retaining Ring 

All personnel were trained per standards 

Contract SOW was sufficiently clear and complete 

Maintenance COM implemented SOW accurately 

Training process was followed 




No Organizational Factors 




Configuration Control 

■ No real identified deficiency since documentation was silent 
on Retaining Ring 

■ Contract SOW was sufficiently clear and complete 

■ COM shifted responsibility to lead supervisors 

■ Supervisors relies on CMP as the point of 
application — defines when CC is required. 

■ No requirement in CMP for precooler R&R 

■ No past mishaps with this factor as a cause 



No Organizational Factors 



Documentation Update 

dKSotxte Documentation does have clear inaccuracies 
rUhack of knowledge mitigates some failure to update 

■ Process & policy is clear and reinforced 

H Submissions to documentation are occurring by 
employees 

■ No past mishaps with thi s as a factor as a cause 




Significant Observations 



Contractor Parts Process does not 

■ Verify FAA certification for a specific part 

■ Monitor vendor viability (FAA alerts) 

■ Monitor specific part quality (GIDEP) 

■ Mishap vendor was 

■ No| listed as authorized to repair this specific part -ladmin mistake by 
FAA 

■ Lost certification for a period of time (FAA alert) for oil precoolers 

■ Under investigation again 



Significant Observations 



Aircrew local & sim training was incomplete on 
Aux Master Warning Circuit Breaker 

Some incidents reviewed had no investigation 
documentation, tough to get answers / prevents 
trending. 




Correct maintenance technical data and improve 
config control to prevent RR absence 

Redesign the Pylon Hot Warning System for the 
NASA fleet to |mprove sensor wiring integrity 

Inspect for RR just prior to installation 

Bar trainees unqualified in task from signing off 
work as primary technician 



